A focus on the NIS2 Directive
The NIS2 Directive increases the minimum requirements for the IT security of critical infrastructure and affects significantly more organisations than its predecessor. What changes are coming your way? What should you do now to be well prepared? Find the answers to the most important questions below.
What is NIS2?
The NIS2 Directive (Network and Information Systems 2) is a legal act that sets a goal to be reached by EU countries and defines minimum requirements for the cybersecurity of critical infrastructure. With its implementation, the European Commission is aiming to improve the level of cybersecurity in the European Union and strengthen international cooperation in combatting cyberattacks. NIS2 has been in force since 16 January 2023, and Member States must incorporate it into their national legislation by 17 October 2024. This is going to help around 160,000 entities tighten their grip on security and make Europe a safe place to live and work. It will also enable information sharing with the private sector and partners around the world. If we are being attacked on an industrial scale, we need to respond on an industrial scale.
What does NIS2 mean in the Netherlands?
Since January 2023, the central government has been working on national implementation by transposing the directive into Dutch law. However, the Dutch government announced that the proposed preliminary consultation round will be delayed until the summer of 2024.
The results of that consultation will be published and, where possible, incorporated into the bills. Only after consideration by the parliament can the law enter into force. This means that the Netherlands is not expected to meet the deadline for introducing the law, which has been set for the end of this year.
Nevertheless, the European NIS2 directive will still go ahead as planned and the rules will apply. Organizations in the Netherlands covered by the NIS2 Directive will have to comply with the legislation, even if there is no concrete legal text.
To be well prepared, organizations should start now and not wait until the draft is finalized. After all, the deadline for NIS2 implementation will not be met, and advisory resources tend to become scarce if things are left to the last minute.
The most important changes of NIS2 at a glance
The NIS2 Directive revises and replaces the 2016 NIS Directive. The most important changes are as follows:
- Significantly more organisations are affected. The number of sectors has been increased to 18. Seven new important sectors have been added and the thresholds have been reduced.
- Organisations must be able to assess the risk of a cyberattack across their supply chain.
- Cyber risk management has become mandatory.
- Organisations must provide employee training and complete audits on cybersecurity.
- The senior management is personally liable for any damage caused by failing to comply with their cyber risk management obligations.
- Severe penalties can be imposed in case of violations.
- Strict reporting requirements must be adhered to.
- The Member States must designate a national CSIRT (Computer Security Incident Response Team). Please click here to find more country specific information.
Do you have any questions?
Talk about NIS2 and cybersecurity.
Whether you need strategic or technical support, we are here to help you.
Pieter Molen
Technical Director
Am I affected by NIS2?
Organisations must clarify themselves whether they fall within the scope of NIS2, and must register with the authorities if required. The Dutch Authority for Digital Infrastructure created a self assessment tool to check if NIS2 is applicable for your organisation. The criteria are as follows:
You were already critical infrastructure
Then you are automatically affected by NIS2.
You are in one of the 18 sectors
And you also have at least 50 employees and an annual turnover of at least 10 million euro.
Essential sectors vs important sectors
The NIS2 Directive differentiates between essential sectors and important sectors as well as between medium-sized and large sectors. This categorization affects the level of sanctions and supervision by authorities.
Company size
The following thresholds apply within the sectors:
- Medium-sized companies = 50 to 249 employees, turnover under 50 million euro and/or a balance sheet under 43 million euro.
- Large companies = at least 250 employees, turnover of at least 50 million euro and/or a balance sheet of at least 43 million euro.
Special cases
Several special cases included in the category of essential sectors are affected by the NIS2 Directive irrespective of their size, such as qualified trust service providers, TLD registries and DNS service providers.
Essential sectors – and important sectors
The NIS2 Directive identifies these 18 sectors
Essential sectors
- Energy (electricity, oil, water, hydrogen)
- Health (hospitals, laboratories, research and development, pharmaceuticals, medical device manufacturers)
- Transport (air, rail, water, road)
- Banking and finance
- Drinking water
- Waste water
- Digital infrastructure (IXPs, cloud providers, data centers, CDNs, TSPs, electronic communication providers)
- ICT service management in B2B
- Space
- Public administration (central government, regional governments)
Important sectors
- Postal and courier services
- Waste management
- Chemical products
- Food
- Processing / manufacturing industries
- Digital services (online marketplaces, search engines, social networks)
- Research
Do you supply an essential or important sector?
Then you are also indirectly affected by NIS2, because the directive requires critical infrastructure providers as well as important and essential sectors in the 18 sectors identified to consider cybersecurity across their supply chains. Those who would like to continue receiving orders must assume that discussions on cybersecurity will become the norm in contract negotiations in future.
Requirements of the NIS2 Directive for CEOs/senior management
NIS2 places emphasis on cyber risk management forming part of corporate risk management – and for good reason, as cyberattacks are the greatest risk faced by businesses today. Ensuring business continuity is particularly important in the area of critical infrastructure. This is why NIS2 places responsibility on CEOs: they must support measures for cyber risk management and monitor implementation. CEOs that do not fulfil their cyber risk management obligations are personally liable for the associated risks and/or damages.
For CEOs that have not had much to do with cybersecurity so far, cyber risk management is new ground. In practice, NIS2 means CEOs must be able to identify and assess cyber risks and decide which are acceptable for the organisation and which are not. This involves considering the probability and the expected scope of damage of cyberattacks for their organisation. An essential precondition for this is conducting regular meetings with the individual or individuals responsible for IT security. Nevertheless, according to a study by Trend Micro, 51 percent of the IT teams included in the survey already speak to management about cyber risks once a week.
Requirements of the NIS2 Directive for CISOs/IT security managers
IT security managers are the ones that are faced with the challenge of implementing the NIS2 Directive. Article 21 of the directive lists the minimum requirements for cybersecurity. Apart from cyber risk management, the list also includes backup management, incident management, policies and procedures regarding the use of cryptography as well as access control and identity management, for example. The good news: If you have established standard security best practices, you can already tick off many of the requirements.
For cyber risk management, CISOs/IT security managers must be able to clearly communicate to management at any time what the current risk status looks like, which risks are most urgent and what measures the organisation should take. Cyber risk management must be conducted continuously, as the attack surface and threat environment are constantly changing.
Trend Micro supports the implementation of NIS2 by providing the most advanced security technology.
Cyber risk management made easy with ASRM
Attack Surface Risk Management (ASRM) by Trend Micro uses AI to automatically calculate the risk score of your IT environment. During this process, the technology approaches your environment from the attacker’s perspective: it collects internal data from connected sensors and correlates it with security information from countless external sources, including publications by government agencies, police organisations, security companies and analysts. A dashboard provides an overview, and traffic light visuals communicate immediately how dangerous the calculated risk is. ASRM will alert you as soon as a certain threshold is exceeded and will show you details – such as which systems are affected. It also recommends countermeasures and even allows you to automatically address risks.
Minimise the scope of damage with XDR
As all risks can never be eliminated, you should always consider the possibility of an attack, despite implementing the best security measures. To minimize the scope of damage, you should be able to quickly detect and stop any incident that may occur. The best way to do this is using Trend Micro XDR (Extended Detection and Response). XDR achieves transparency throughout your whole IT environment, collects Security Intelligence from all connected systems and uses AI to correlate it into actionable alerts. This reduces the number of false positives, allowing you to see at a glance what has happened, which systems are affected and where action is required.
How ASRM and XDR work together
ASRM and XDR are both integrated into the cybersecurity platform Trend Vision One, from which they can be centrally monitored and controlled. Both technologies access the same sensors and communicate with each other. If ASRM detects a risk, XDR will investigate it in more detail, and if XDR detects signs of a cyberattack, ASRM will immediately adjust the risk status. Together, the two technologies minimize both the probability of a cyberattack and the scope of damage.
Trend Micro recognized as a Leader
Forrester Wave™: Endpoint Security, Q4 2023
Trend Micro has been awarded the highest score in the Strategy category with the highest possible marks in Innovation, Roadmap, and Adoption.
Free webinar series on NIS2
#Get ready for NIS2
Trend Micro has put together a series of 6 webinars to help enterprises get ready for NIS2. Register for the live webinars or catch up on-demand and find out how Trend Micro is supporting enterprises in meeting the new guidelines.
Possible solutions for NIS2
Trend Micro solutions that support the implementation of NIS2
Requirements of the NIS2 Directive for compliance managers
To ensure that your organisation complies with NIS2, you must be thoroughly familiar with the regulatory requirements, document the measures taken and review their effectiveness. You should also provide training to raise awareness among employees of NIS2 compliance. Essential and important entities must report any significant incident without delay to the competent national authorities of any incident that seriously affects services in the sectors or sub-sectors listed in Annexes I and II of the Directive.
The final requirements in each member state will only become clear once the member states’ acts for implementing NIS2 are passed. Until then, the recommendation is to become familiar with the current state of legislation in your member country (and the European NIS2 directive).
NIS2 and GDPR
GDPR will most likely rank higher than NIS2. In case of incidents involving both laws, the severity of penalties will be based on GDPR. The fines stipulated by GDPR for particularly serious violations are twice as high and can reach 20 million euro or 4 percent of worldwide annual turnover.
FAQs
What penalties can be imposed in case of non-compliance with the NIS2 Directive?
Those who fail to fulfil their obligations under NIS2 must expect severe sanctions. The implementation of the directive provides for different fines that apply to important sectors or critical infrastructure providers and essential sectors. In case of common offences, the same heavy penalties apply to all groups.
- Essential sectors: (Temporarily) suspend certification or authorisation concerning part or all of the relevant services provided or activities carried out by the entity and prevent any natural person responsible for discharging managerial responsibilities at the entity’s chief executive or legal representative level from exercising managerial functions
- Critical infrastructure providers and essential sectors: up to 10 million euro or 2% of annual turnover
- Important sectors: up to 7 million euro or 1.4% of annual turnover
Relevant resources
NIS2 Overview
How Trend Micro supports your NIS2 compliance journey
NIS2 Directive: Everything you need to know
The main changes in the new NIS2 directive are:
The Key to NIS2 is Risk Management
In this webinar we discuss the new NIS2 Directive and discover why taking a risk-based approach to cybersecurity is crucial for businesses today
Do you have any questions?
Talk about NIS2 and cybersecurity.
Whether you need strategic or technical support, we are here to help you.
Pieter Molen
Technical Director